From fec2ec11d30634136726eecdda7039a900a410d0 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Wed, 22 Apr 2026 10:08:37 +0200 Subject: [PATCH] docs(wiki): Expand wiki to comprehensive SecuBox documentation - Update Home.md with full SecuBox system overview - Add Architecture-Boot.md (5-layer boot chain, CSPN compliance) - Add Design-System.md (6-module color system, typography) - Add Developer-Guide.md (stack, conventions, patterns) - Add Modules.md (all 125 modules with screenshots) - Update _Sidebar.md with comprehensive navigation - Fix fb_dashboard.py type hint for _read_from_socket Wiki now covers: system overview, architecture, modules, security, development guidelines, Eye Remote, and all hardware platforms. Co-Authored-By: Claude Opus 4.5 --- docs/wiki/Architecture-Boot.md | 137 +++ docs/wiki/Design-System.md | 184 ++++ docs/wiki/Developer-Guide.md | 196 ++++ docs/wiki/Home.md | 186 +++- docs/wiki/Modules.md | 1723 +++++++++++++++++++++++++++++++ docs/wiki/_Sidebar.md | 50 +- remote-ui/round/fb_dashboard.py | 2 +- 7 files changed, 2436 insertions(+), 42 deletions(-) create mode 100644 docs/wiki/Architecture-Boot.md create mode 100644 docs/wiki/Design-System.md create mode 100644 docs/wiki/Developer-Guide.md create mode 100644 docs/wiki/Modules.md diff --git a/docs/wiki/Architecture-Boot.md b/docs/wiki/Architecture-Boot.md new file mode 100644 index 00000000..67805c5c --- /dev/null +++ b/docs/wiki/Architecture-Boot.md @@ -0,0 +1,137 @@ +# Boot Architecture + +**SecuBox-DEB** uses a five-layer boot chain from hardware firmware to user space. Three exclusive execution modes are available: maintenance (`PROMPT`), display (`KIOSK`), or production (`API`). + +--- + +## Boot Chain Overview + +### Layer 1 — HW / BootLoader + +| Platform | Firmware | Notes | +|----------|----------|-------| +| Lenovo ThinkCentre M710q | BIOS/UEFI | x86_64, Secure Boot capable | +| MOCHAbin (Armada 7040) | U-Boot | ARM64, eMMC or NVMe boot | +| ESPRESSObin (Armada 3720) | U-Boot | ARM64, SD or eMMC boot | + +### Layer 2 — OS / UEFI (GRUB2) + +GRUB2 handles kernel selection, signature verification (Secure Boot), and optional TPM2 unsealing (`tpm2_unseal`). + +**CSPN Compliance Points:** +- `/boot` partition is unencrypted (FAT32/ext4) but protected by UEFI signature verification +- Kernel command line parameters are locked in production +- GRUB password is mandatory on production targets + +### Layer 3 — Kernel + InitRamfs + +#### Hardened Linux Kernel + +``` +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_MODULE_SIG=y +CONFIG_MODULE_SIG_SHA512=y +CONFIG_HARDENED_USERCOPY=y +CONFIG_RANDOMIZE_BASE=y # KASLR +``` + +Built-in modules: `nftables`, `WireGuard`, `eBPF` (restricted), MOCHAbin network drivers (mvneta/mvpp2). + +#### InitRamfs Operations + +1. Mount encrypted LUKS2 disk (`cryptsetup luksOpen`) +2. Verify ZKP pre-mount proof (GK·HAM-HASH L1) +3. Mount encrypted root on `/sysroot` +4. `switch_root` to Rootfs + +### Layer 4 — Rootfs / INIT (systemd) + +After `pivot_root`, systemd orchestrates the 10-phase SecuBox-DEB startup: + +| Phase | Services | SecuBox Pairs | +|-------|----------|---------------| +| 1 — Network | nftables, WireGuard, Tailscale | MESH↔AUTH | +| 2 — Perimeter Security | CrowdSec, HAProxy | WALL↔MIND | +| 3 — DPI dual-stream | nDPId (active/shadow) | WALL↔MIND | +| 4 — Runtime API | FastAPI/Uvicorn, 4R buffer | BOOT↔ROOT | +| 5 — ZKP auth | GK·HAM-HASH (L1/L2/L3) | BOOT↔ROOT | +| 6 — MirrorNet P2P | WireGuard + did:plc | MESH↔AUTH | +| 7 — Notarization | ALERTE·DÉPÔT blind notarization | WALL↔MIND | +| 8 — Display | HyperPixel / RPi Zero coprocessor | MESH↔AUTH | +| 9 — Monitoring | Metrics, alerts, SIEM | WALL↔MIND | +| 10 — Finalization | Health-check, seal TPM2 | BOOT↔ROOT | + +--- + +## Execution Modes + +### PROMPT `` — Maintenance Mode + +**Target:** `secubox-prompt.target` + +- Shell access via physical console or restricted SSH +- Full audit logging (`auditd` + `systemd-journal`, 90-day retention) +- Production services (API, DPI, MirrorNet) are stopped + +```bash +echo "MODE=PROMPT" > /etc/secubox/runtime.conf +systemctl isolate secubox-prompt.target +``` + +### KIOSK `[UI]` — Display Mode + +**Target:** `secubox-kiosk.target` + +- Locked UI for metrics display on HyperPixel +- No shell access, no inbound network interfaces +- Communication via Unix socket (read-only) +- Auto-restart on crash + +```bash +echo "MODE=KIOSK" > /etc/secubox/runtime.conf +systemctl isolate secubox-kiosk.target +``` + +### API `(RT)` — Production Mode + +**Target:** `secubox-api.target` (default) + +- FastAPI/Uvicorn on Unix socket (HAProxy TLS frontend) +- 4R double-buffer active on L2 +- nDPId dual-stream listening +- CrowdSec in agent mode +- No interactive shell, no external SSH + +```bash +echo "MODE=API" > /etc/secubox/runtime.conf +systemctl isolate secubox-api.target +``` + +--- + +## Module Color Correspondence + +| Color | Hex | Layer / Mode | +|-------|-----|--------------| +| BOOT | `#803018` | HW / BootLoader | +| WALL | `#9A6010` | OS / UEFI | +| MIND | `#3D35A0` | Kernel + InitRamfs | +| ROOT | `#0A5840` | Rootfs / INIT — API Mode | +| MESH | `#104A88` | KIOSK Mode [UI] | +| AUTH | `#C04E24` | PROMPT Mode \ | + +--- + +## CSPN Control Points + +- [ ] Kernel and module signatures verified by Secure Boot +- [ ] InitRD without plaintext secrets (`lsinitrd | grep -i key`) +- [ ] TPM2 sealing to PCR 0+7+14 validated after kernel updates +- [ ] PROMPT mode only accessible via physical console or certificate SSH +- [ ] Audit logs exported and signed before each PROMPT session +- [ ] API mode won't start if ZKP L1 proof fails +- [ ] Network isolation between modes verified by `nft list ruleset` + +--- + +*See also: [[Architecture-Security]], [[Architecture-Modules]]* diff --git a/docs/wiki/Design-System.md b/docs/wiki/Design-System.md new file mode 100644 index 00000000..3ca8f0ac --- /dev/null +++ b/docs/wiki/Design-System.md @@ -0,0 +1,184 @@ +# Design System + +SecuBox uses a **six-module color system** with complementary pairs for visual consistency across all interfaces. + +--- + +## Module Colors + +| Module | Code | Color | Hex | Description | +|--------|------|-------|-----|-------------| +| **AUTH** | 01 | Orange (Coral Auth) | `#C04E24` | Authentication, zero-trust | +| **WALL** | 02 | Yellow (Amber Shield) | `#9A6010` | Firewall, nftables | +| **BOOT** | 03 | Red (Coral Launch) | `#803018` | Deployment, provisioning | +| **MIND** | 04 | Violet (Violet Mind) | `#3D35A0` | AI, behavioral analysis, nDPId | +| **ROOT** | 05 | Green (Teal Root) | `#0A5840` | Terminal CLI, Debian system | +| **MESH** | 06 | Blue (Blue Mesh) | `#104A88` | Network, WireGuard, Tailscale | + +### Complementary Pairs + +- **Red ↔ Green** (BOOT ↔ ROOT) — System deployment and operation +- **Yellow ↔ Violet** (WALL ↔ MIND) — Security and intelligence +- **Blue ↔ Orange** (MESH ↔ AUTH) — Network and access control + +--- + +## Color Palette Details + +### AUTH (Orange) +```css +--auth-main: #C04E24; +--auth-light: #E8845A; +--auth-xlt: #FAECE7; +--auth-dark: #7A2A10; +``` + +### WALL (Yellow/Amber) +```css +--wall-main: #9A6010; +--wall-light: #CC8820; +--wall-xlt: #FDF3E0; +--wall-dark: #5A3808; +``` + +### BOOT (Red) +```css +--boot-main: #803018; +--boot-light: #C06040; +--boot-xlt: #FAECE7; +--boot-dark: #5A1E0A; +``` + +### MIND (Violet) +```css +--mind-main: #3D35A0; +--mind-light: #7068D0; +--mind-xlt: #EEEDFE; +--mind-dark: #241D6A; +``` + +### ROOT (Green/Teal) +```css +--root-main: #0A5840; +--root-light: #148C66; +--root-xlt: #E1F5EE; +--root-dark: #063828; +``` + +### MESH (Blue) +```css +--mesh-main: #104A88; +--mesh-light: #2C70C0; +--mesh-xlt: #E6F1FB; +--mesh-dark: #08305A; +``` + +--- + +## Light Theme Base Colors + +```css +--bg: #FFFFFF; +--surface: #FAFAF8; +--surface2: #F4F3EF; +--border: #E2E0D8; +--border2: #C8C6BE; +--text: #1A1A18; +--muted: #6B6963; +``` + +--- + +## Dark Theme (Eye Remote / Dashboard) + +```css +--cosmos-black: #0a0a0f; +--gold-hermetic: #c9a84c; +--cinnabar: #e63946; +--matrix-green: #00ff41; +--void-purple: #6e40c9; +--cyber-cyan: #00d4ff; +--text-primary: #e8e6d9; +--text-muted: #6b6b7a; +``` + +--- + +## Typography + +### Font Stack +- **Display/Heading**: Space Grotesk (300-700) +- **Body**: Space Grotesk 400 +- **Monospace/Code**: JetBrains Mono (400, 700) + +### Usage + +```css +/* Display - titles */ +font-size: 56px; +font-weight: 700; +letter-spacing: -2px; +color: var(--root-main); + +/* Heading */ +font-size: 24px; +font-weight: 600; +letter-spacing: -0.4px; + +/* Body */ +font-size: 14-16px; +font-weight: 400; +line-height: 1.6-1.7; + +/* Code/Terminal */ +font-family: 'JetBrains Mono', monospace; +font-size: 12px; +``` + +--- + +## Brand Identities + +| Brand | Color | Usage | +|-------|-------|-------| +| **SecuBox·** | Green (Root) | Main product brand | +| **Gondwana** | Violet (Mind) | Public/external brand | +| **CyberMind** | Orange (Auth) | Internal/confidential brand | + +--- + +## Module Icons/Symbols + +| Module | Symbol | Description | +|--------|--------|-------------| +| AUTH | Hexagonal target | Controlled access, verified identity | +| WALL | Flaming brick wall | nftables, inbound/outbound rules | +| BOOT | Rocket | Provisioning, fast boot, deployment | +| MIND | Robot | Automation, behavioral analysis | +| ROOT | $>_ prompt | Console access, low-level system | +| MESH | Network gear | WireGuard, Tailscale, mesh topology | + +--- + +## Spacing System + +| Size | Pixels | Usage | +|------|--------|-------| +| XS | 4px | Icon gaps | +| S | 8px | Chips | +| M | 16px | Padding | +| L | 24px | Sections | +| XL | 40px | Margins | +| 2XL | 56px | Cover | + +--- + +## Grid System + +- 12-column grid +- Gap: 8px +- Border radius: 14px (cards), 6px (swatches), 3px (small elements) + +--- + +*© 2026 CyberMind · Notre-Dame-du-Cruet, Savoie* diff --git a/docs/wiki/Developer-Guide.md b/docs/wiki/Developer-Guide.md new file mode 100644 index 00000000..04fdb6b2 --- /dev/null +++ b/docs/wiki/Developer-Guide.md @@ -0,0 +1,196 @@ +# Developer Guide + +Getting started with SecuBox-DEB development. + +--- + +## Tech Stack + +### Base System +- **OS**: Debian 12 (Bookworm) ARM64 +- **Kernel**: 6.x with netfilter, tc, eBPF modules +- **Transport**: Tailscale (WireGuard-based mesh) +- **Containers**: Docker / Podman + +### Security Stack +- **Firewall**: nftables (not iptables) +- **IDS/IPS**: Suricata + CrowdSec +- **WAF**: HAProxy + mitmproxy +- **DNS**: Unbound (Vortex DNS) + blocklists +- **DPI**: nDPId + netifyd (dual-stream via tc mirred) +- **Auth**: SecuBox-ZKP (Hamiltonian NP / GK-HAM-2025) +- **P2P Mesh**: MirrorNet (did:plc + WireGuard + Chain of Hamiltonians) + +### Application Stack +- **Backend**: Python 3.11+ (FastAPI / Flask), Bash, C +- **Frontend**: HTML/CSS/JS vanilla or React +- **Config**: YAML + TOML, double-buffer / 4R versioning +- **Pipeline**: 5-stage production pipeline (collect → process → analyze → report → alert) + +--- + +## Code Conventions + +### Python + +```python +""" +SecuBox-Deb :: +CyberMind — https://cybermind.fr +Author: Gérald Kerma +License: Proprietary / ANSSI CSPN candidate +""" + +from fastapi import APIRouter, Depends +from pydantic import BaseModel + +router = APIRouter(prefix="/api/v1/module", tags=["module"]) + +class MetricsResponse(BaseModel): + cpu_percent: float + mem_percent: float +``` + +### Bash + +```bash +#!/usr/bin/env bash +# SecuBox-Deb :: +# CyberMind — Gérald Kerma +set -euo pipefail +readonly MODULE="" +readonly VERSION="" +``` + +### nftables + +```nft +#!/usr/sbin/nft -f +flush ruleset + +table inet filter { + chain input { + type filter hook input priority 0; policy drop; + ct state established,related accept + iif lo accept + log prefix "[SECUBOX-MODULE] " level info + } +} +``` + +--- + +## Double-Buffer / 4R Pattern + +All configuration uses the PARAMETERS module with 4R versioning: + +``` +/etc/secubox// +├── active/ → live config (read-only in prod) +├── shadow/ → editable, validation before swap +├── rollback/ → 4 timestamped snapshots (R1..R4) +└── pending/ → awaiting ZKP validation +``` + +### Operations + +```bash +# Swap double-buffer (atomic) +secubox-params swap --module --validate-zkp + +# Rollback to R1 +secubox-params rollback --module --target R1 + +# Check config status +secubox-params status --module +``` + +--- + +## FastAPI Module Structure + +``` +packages/secubox-/ +├── api/ +│ ├── __init__.py +│ ├── main.py ← FastAPI app with router +│ └── routers/ +│ └── metrics.py ← Endpoint implementations +├── core/ +│ ├── config.py ← TOML configuration +│ └── service.py ← Business logic +├── models/ +│ └── schemas.py ← Pydantic models +├── www/ +│ ├── index.html ← Web UI (from OpenWrt port) +│ └── static/ +├── debian/ +│ ├── control +│ ├── rules +│ ├── postinst +│ └── prerm +└── README.md +``` + +--- + +## Common Commands + +```bash +# Build .deb package (cross-compile for ARM64) +cd packages/secubox- +dpkg-buildpackage -a arm64 --host-arch arm64 -us -uc -b + +# Deploy to device via SSH +bash scripts/deploy.sh secubox- root@192.168.1.1 + +# Run API in development mode +uvicorn api.main:app --reload --uds /tmp/.sock + +# Run tests +pytest tests/ -v + +# Check system status +systemctl status secubox-* --no-pager + +# View live logs +journalctl -u secubox-* -f --output json | jq '.MESSAGE' +``` + +--- + +## ANSSI CSPN Compliance + +1. **Privilege separation** by layer (L1/L2/L3) +2. **Encryption**: TLS 1.3 minimum +3. **Authentication**: ZKP Hamiltonian (GK-HAM-2025) — no plaintext secrets +4. **Logs**: Immutable, RFC 3339 timestamped, secure rotation +5. **Rollback**: Every config change → 4R snapshot mandatory +6. **Attack surface**: Minimal — disable unused services +7. **Tests**: Coverage ≥ 80%, regression tests on every PR + +--- + +## What NOT to Do + +- Use `iptables` (replaced by nftables) +- Use `uci` / LuCI (that's SecuBox-OpenWrt — abandoned) +- Write secrets in plaintext in code +- Use ACCEPT default firewall policies +- Suggest Python libraries with known vulnerabilities +- Ignore double-buffer schema for configs +- Mention "CrowdSec Ambassador" or "CyberMind Produits SASU" + +--- + +## References + +- [ANSSI CSPN](https://www.ssi.gouv.fr/entreprise/certification_cspn/) +- [nDPId](https://github.com/utoni/nDPId) +- [CrowdSec Docs](https://docs.crowdsec.net) +- [Suricata Docs](https://docs.suricata.io) +- [nftables Wiki](https://wiki.nftables.org) + +--- + +*See also: [[Developer-Patterns]], [[Architecture-Boot]], [[Design-System]]* diff --git a/docs/wiki/Home.md b/docs/wiki/Home.md index d615c802..ab13959d 100644 --- a/docs/wiki/Home.md +++ b/docs/wiki/Home.md @@ -1,54 +1,176 @@ -# SecuBox-DEB Wiki +# SecuBox -Welcome to the SecuBox-DEB documentation wiki. +**CyberMind · Gondwana · Notre-Dame-du-Cruet · Savoie** | [FR](Home-FR) | [DE](Home-DE) | [中文](Home-ZH) -## Eye Remote +Complete security appliance solution ported from OpenWrt to Debian bookworm. Designed for GlobalScale ARM64 boards (MOCHAbin, ESPRESSObin) and x86_64 systems. **125 packages** with **2000+ API endpoints**. -The Eye Remote is a compact USB gadget display for monitoring SecuBox metrics. +--- + +## 🔴 BOOT — Quick Start + +### VirtualBox (2 Minutes) ⭐ + +Test SecuBox instantly in VirtualBox — no USB drive needed: + +```bash +# Download latest image +wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz +gunzip secubox-live-amd64-bookworm.img.gz + +# Convert to VDI format +VBoxManage convertfromraw secubox-live-amd64-bookworm.img secubox-live.vdi --format VDI + +# Create and start VM +curl -sLO https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/image/create-vbox-vm.sh +chmod +x create-vbox-vm.sh +./create-vbox-vm.sh secubox-live.vdi +``` + +**One-liner with auto-download:** + +```bash +curl -sL https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/image/create-vbox-vm.sh | bash -s -- --download +``` + +See [[Live-USB-VirtualBox]] for full documentation. + +### Live USB (Hardware) ⚡ + +Boot directly from USB on physical hardware: + +```bash +wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz +zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress +``` + +See [[Live-USB]] for complete guide. + +### APT Installation (Existing Debian) + +```bash +curl -fsSL https://apt.secubox.in/install.sh | sudo bash +sudo apt install secubox-full # or secubox-lite +``` + +See [[Installation]] for detailed instructions. + +--- + +## 🟠 AUTH — Access Credentials + +| Service | Username | Password | +|---------|----------|----------| +| **Web UI** | admin | secubox | +| **SSH** | root | secubox | +| **Access** | https://localhost:9443 | SSH port 2222 | + +--- + +## 🟢 ROOT — System Requirements + +| Board | SoC | Profile | Use Case | +|-------|-----|---------|----------| +| MOCHAbin | Armada 7040 | Full | Enterprise Gateway | +| ESPRESSObin v7 | Armada 3720 | Lite | Home/SMB Router | +| ESPRESSObin Ultra | Armada 3720 | Lite+ | Home with Wi-Fi | +| Raspberry Pi 400 | BCM2711 | Full | Maker Projects | +| VM x86_64 | Any | Full | Testing/Development | +| QEMU ARM64 | Emulated | Full | ARM testing on x86 | + +--- + +## 🟣 MIND — Feature Overview + +| Stack | Description | Modules | +|-------|-------------|---------| +| 🟠 **AUTH** | Authentication, ZeroTrust, MFA | auth, portal, users, nac | +| 🟡 **WALL** | Firewall, CrowdSec, WAF, IDS/IPS | crowdsec, waf, threats, ipblock | +| 🔴 **BOOT** | Deployment, provisioning | cloner, vault, vm, rezapp | +| 🟣 **MIND** | AI, behavioral analysis, DPI | dpi, netifyd, ai-insights, soc | +| 🟢 **ROOT** | System, CLI, hardening | core, hub, system, console | +| 🔵 **MESH** | Network, WireGuard, QoS | wireguard, haproxy, netmodes, turn | + +**Total: 125 packages** + +See [[Modules]] for complete module documentation. + +--- + +## 🔵 MESH — Documentation Index + +### Getting Started +- [[Live-USB-VirtualBox|VirtualBox Quick Start]] ⭐ +- [[Live-USB]] — Bootable USB guide +- [[ARM-Installation]] — ARM boards & U-Boot ⚡ +- [[QEMU-ARM64]] — ARM emulation on x86 🖥️ + +### Configuration +- [[Configuration]] — System configuration +- [[Troubleshooting]] — Common issues + +### Architecture +- [[Architecture-Boot]] — 5-layer boot architecture +- [[Architecture-Modules]] — Module interaction design +- [[Architecture-Security]] — CSPN compliance & ZKP + +### Development +- [[Developer-Guide]] — Getting started with development +- [[Developer-Patterns]] — FastAPI migration patterns +- [[Design-System]] — UI/UX guidelines and module colors + +### Reference +- [[Modules]] — All 125 modules +- [[API-Reference]] — REST API (2000+ endpoints) +- [[Hardware-ESPRESSObin]] — ESPRESSObin setup +- [[Hardware-MOCHAbin]] — MOCHAbin setup + +--- + +## 👁️ Eye Remote + +The Eye Remote is a compact USB gadget display for monitoring SecuBox metrics in real-time. | Page | Description | |------|-------------| -| [Eye Remote Implementation](Eye-Remote-Implementation.md) | Architecture, API, and implementation guide | -| [Eye Remote Hardware](Eye-Remote-Hardware.md) | Hardware setup, GPIO pinout, display configuration | -| [Eye Remote Gateway](Eye-Remote-Gateway.md) | Gateway emulator for development and testing | +| [[Eye-Remote-Implementation]] | Architecture, API, and implementation guide | +| [[Eye-Remote-Hardware]] | Hardware setup, GPIO pinout, display configuration | +| [[Eye-Remote-Gateway]] | Gateway emulator for development and testing | -### Quick Start - -1. **Hardware**: Raspberry Pi Zero W + HyperPixel 2.1 Round (480×480) -2. **Connection**: USB OTG (10.55.0.0/30) or WiFi -3. **Dashboard**: Python framebuffer rendering (no browser needed) - -### Build Image +**Hardware**: Raspberry Pi Zero W + HyperPixel 2.1 Round (480×480) +**Connection**: USB OTG (10.55.0.0/30) or WiFi +**Dashboard**: Python framebuffer rendering (no browser needed) ```bash -# Lightweight framebuffer mode (recommended) +# Build Eye Remote image (lightweight framebuffer mode) cd remote-ui/round sudo ./build-eye-remote-image.sh -i raspios-lite.img.xz --framebuffer -# With WiFi pre-configured -sudo ./build-eye-remote-image.sh -i raspios-lite.img.xz -s "SSID" -p "password" -``` - -### Test with Emulator - -```bash -# Start gateway emulator +# Test with gateway emulator cd tools/secubox-eye-gateway -pip install -e . secubox-eye-gateway --profile stressed --port 8765 - -# Test on desktop (requires pygame) -cd remote-ui/round -python3 test-dashboard-amd64.py --api http://localhost:8765 +python3 remote-ui/round/test-dashboard-amd64.py --api http://localhost:8765 ``` --- -## Other Documentation +## 🟡 WALL — Security Features -- [CLAUDE.md](../../CLAUDE.md) — Project conventions and migration guide -- [Porting Guide](../PORTING-GUIDE.md) — OpenWrt to Debian migration +- **CrowdSec** — Community-driven IDS/IPS +- **WAF** — 300+ ModSecurity rules +- **nftables** — Default DROP policy +- **AI-Insights** — ML threat detection +- **IPBlock** — Automated blocklist management +- **MAC-Guard** — MAC address control --- -*CyberMind · SecuBox-DEB · April 2026* +## Links + +- [GitHub Repository](https://github.com/CyberMind-FR/secubox-deb) +- [Releases](https://github.com/CyberMind-FR/secubox-deb/releases) +- [Issues](https://github.com/CyberMind-FR/secubox-deb/issues) +- [CyberMind](https://cybermind.fr) + +--- + +*© 2026 CyberMind · Notre-Dame-du-Cruet, Savoie* diff --git a/docs/wiki/Modules.md b/docs/wiki/Modules.md new file mode 100644 index 00000000..5622714a --- /dev/null +++ b/docs/wiki/Modules.md @@ -0,0 +1,1723 @@ +# SecuBox Modules + +*Complete module documentation* + +**Total modules:** 124 + +[🇬🇧 English](MODULES-EN.md) | [🇫🇷 Français](MODULES-FR.md) | [🇩🇪 Deutsch](MODULES-DE.md) | [🇨🇳 中文](MODULES-ZH.md) + +--- + +## Overview + +| Modules | Category | Description | +|--------|----------|-------------| +| 🏠 **SecuBox Hub** | Dashboard | Central dashboard and control center | +| 🛡️ **Security Operations Center** | Dashboard | SOC with world clock, threat map, tickets | +| 📋 **Migration Roadmap** | Dashboard | OpenWRT to Debian migration tracking | +| 🛡️ **CrowdSec** | Security | Collaborative security engine | +| 🔥 **Web Application Firewall** | Security | WAF with 300+ security rules | +| 🔥 **Vortex Firewall** | Security | nftables threat enforcement | +| 🔒 **System Hardening** | Security | Kernel and system hardening | +| 🔍 **MITM Proxy** | Security | Traffic inspection and WAF proxy | +| 🔐 **Auth Guardian** | Security | Authentication management | +| 🛡️ **Network Access Control** | Security | Client guardian and NAC | +| 🌐 **Network Modes** | Network | Network topology configuration | +| 📊 **QoS Manager** | Network | Quality of Service with HTB/VLAN | +| 📈 **Traffic Shaping** | Network | TC/CAKE traffic shaping | +| ⚡ **HAProxy** | Network | Load balancer dashboard | +| 🚀 **CDN Cache** | Network | Content delivery cache | +| 🏗️ **Virtual Hosts** | Network | Nginx virtual host management | +| 🌍 **DNS Server** | DNS | BIND DNS zone management | +| 🛡️ **Vortex DNS** | DNS | DNS firewall with RPZ | +| 📡 **Mesh DNS** | DNS | Mesh network domain resolution | +| 🔗 **WireGuard VPN** | VPN | Modern VPN management | +| 🕸️ **Mesh Network** | VPN | Mesh networking (Yggdrasil) | +| 🔗 **P2P Network** | VPN | Peer-to-peer networking | +| 🧅 **Tor Network** | Privacy | Tor anonymity and hidden services | +| 🌐 **Exposure Settings** | Privacy | Unified exposure (Tor, SSL, DNS, Mesh) | +| 🔐 **Zero-Knowledge Proofs** | Privacy | ZKP Hamiltonian management | +| 📊 **Netdata** | Monitoring | Real-time system monitoring | +| 🔬 **Deep Packet Inspection** | Monitoring | DPI with netifyd | +| 📱 **Device Intelligence** | Monitoring | Asset discovery and fingerprinting | +| 👁️ **Watchdog** | Monitoring | Service and container monitoring | +| 🎬 **Media Flow** | Monitoring | Media traffic analytics | +| 📊 **Metrics Dashboard** | Monitoring | Real-time system metrics | +| 🔐 **Login Portal** | Access | Authentication portal with JWT | +| 👥 **User Management** | Access | Unified identity management | +| 📦 **Services Portal** | Services | C3Box services portal | +| 🦊 **Gitea** | Services | Git server (LXC) | +| ☁️ **Nextcloud** | Services | File sync (LXC) | +| 📧 **Mail Server** | Email | Postfix/Dovecot mail server | +| 💌 **Webmail** | Email | Roundcube/SOGo webmail | +| 📰 **Publishing Platform** | Publishing | Unified publishing dashboard | +| 💧 **Droplet** | Publishing | File upload and publish | +| 📝 **Metablogizer** | Publishing | Static site publisher with Tor | +| 🎨 **Streamlit** | Apps | Streamlit app platform | +| ⚡ **StreamForge** | Apps | Streamlit app development | +| 📦 **APT Repository** | Apps | APT repository management | +| ⚙️ **System Hub** | System | System configuration and management | +| 💾 **Backup Manager** | System | System and LXC backup | + +--- + +## Modules + +### 🏠 SecuBox Hub + +**Category:** Dashboard + +Central dashboard and control center + +**Features:** +- System overview +- Service monitoring +- Quick actions +- Metrics + +![SecuBox Hub](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/hub.png) + +--- + +### 🛡️ Security Operations Center + +**Category:** Dashboard + +SOC with world clock, threat map, tickets + +**Features:** +- World clock +- Threat map +- Ticket system +- P2P intel +- Alerts + +![Security Operations Center](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/soc.png) + +--- + +### 📋 Migration Roadmap + +**Category:** Dashboard + +OpenWRT to Debian migration tracking + +**Features:** +- Progress tracking +- Module status +- Category view + +![Migration Roadmap](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/roadmap.png) + +--- + +### 🛡️ CrowdSec + +**Category:** Security + +Collaborative security engine + +**Features:** +- Decision management +- Alerts +- Bouncers +- Collections + +![CrowdSec](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/crowdsec.png) + +--- + +### 🔥 Web Application Firewall + +**Category:** Security + +WAF with 300+ security rules + +**Features:** +- OWASP rules +- Custom rules +- CrowdSec integration + +![Web Application Firewall](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/waf.png) + +--- + +### 🔥 Vortex Firewall + +**Category:** Security + +nftables threat enforcement + +**Features:** +- IP blocklists +- nftables sets +- Threat feeds + +![Vortex Firewall](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/vortex-firewall.png) + +--- + +### 🔒 System Hardening + +**Category:** Security + +Kernel and system hardening + +**Features:** +- Sysctl hardening +- Module blacklist +- Security score + +![System Hardening](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/hardening.png) + +--- + +### 🔍 MITM Proxy + +**Category:** Security + +Traffic inspection and WAF proxy + +**Features:** +- Traffic inspection +- Request logging +- Auto-ban + +![MITM Proxy](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/mitmproxy.png) + +--- + +### 🔐 Auth Guardian + +**Category:** Security + +Authentication management + +**Features:** +- OAuth2 +- LDAP +- 2FA +- Session management + +![Auth Guardian](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/auth.png) + +--- + +### 🛡️ Network Access Control + +**Category:** Security + +Client guardian and NAC + +**Features:** +- Device control +- MAC filtering +- Quarantine + +![Network Access Control](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/nac.png) + +--- + +### 🌐 Network Modes + +**Category:** Network + +Network topology configuration + +**Features:** +- Router mode +- Bridge mode +- AP mode +- VLAN + +![Network Modes](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/netmodes.png) + +--- + +### 📊 QoS Manager + +**Category:** Network + +Quality of Service with HTB/VLAN + +**Features:** +- Bandwidth control +- VLAN policies +- 802.1p PCP + +![QoS Manager](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/qos.png) + +--- + +### 📈 Traffic Shaping + +**Category:** Network + +TC/CAKE traffic shaping + +**Features:** +- Per-interface QoS +- CAKE algorithm +- Statistics + +![Traffic Shaping](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/traffic.png) + +--- + +### ⚡ HAProxy + +**Category:** Network + +Load balancer dashboard + +**Features:** +- Backend management +- Stats +- ACLs +- SSL termination + +![HAProxy](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/haproxy.png) + +--- + +### 🚀 CDN Cache + +**Category:** Network + +Content delivery cache + +**Features:** +- Cache management +- Purge +- Statistics + +![CDN Cache](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/cdn.png) + +--- + +### 🏗️ Virtual Hosts + +**Category:** Network + +Nginx virtual host management + +**Features:** +- Site management +- SSL certificates +- Reverse proxy + +![Virtual Hosts](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/vhost.png) + +--- + +### 🌍 DNS Server + +**Category:** DNS + +BIND DNS zone management + +**Features:** +- Zone management +- Records +- DNSSEC + +![DNS Server](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/dns.png) + +--- + +### 🛡️ Vortex DNS + +**Category:** DNS + +DNS firewall with RPZ + +**Features:** +- Blocklists +- RPZ +- Threat feeds + +![Vortex DNS](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/vortex-dns.png) + +--- + +### 📡 Mesh DNS + +**Category:** DNS + +Mesh network domain resolution + +**Features:** +- mDNS/Avahi +- Local DNS +- Service discovery + +![Mesh DNS](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/meshname.png) + +--- + +### 🔗 WireGuard VPN + +**Category:** VPN + +Modern VPN management + +**Features:** +- Peer management +- QR codes +- Traffic stats + +![WireGuard VPN](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/wireguard.png) + +--- + +### 🕸️ Mesh Network + +**Category:** VPN + +Mesh networking (Yggdrasil) + +**Features:** +- Peer discovery +- Routing +- Encryption + +![Mesh Network](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/mesh.png) + +--- + +### 🔗 P2P Network + +**Category:** VPN + +Peer-to-peer networking + +**Features:** +- Direct connections +- NAT traversal +- Encryption + +![P2P Network](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/p2p.png) + +--- + +### 🧅 Tor Network + +**Category:** Privacy + +Tor anonymity and hidden services + +**Features:** +- Circuits +- Hidden services +- Bridges + +![Tor Network](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/tor.png) + +--- + +### 🌐 Exposure Settings + +**Category:** Privacy + +Unified exposure (Tor, SSL, DNS, Mesh) + +**Features:** +- Tor exposure +- SSL certs +- DNS records +- Mesh access + +![Exposure Settings](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/exposure.png) + +--- + +### 🔐 Zero-Knowledge Proofs + +**Category:** Privacy + +ZKP Hamiltonian management + +**Features:** +- Proof generation +- Verification +- Key management + +![Zero-Knowledge Proofs](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/zkp.png) + +--- + +### 📊 Netdata + +**Category:** Monitoring + +Real-time system monitoring + +**Features:** +- Metrics +- Alerts +- Charts +- Plugins + +![Netdata](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/netdata.png) + +--- + +### 🔬 Deep Packet Inspection + +**Category:** Monitoring + +DPI with netifyd + +**Features:** +- Protocol detection +- App identification +- Flow analysis + +![Deep Packet Inspection](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/dpi.png) + +--- + +### 📱 Device Intelligence + +**Category:** Monitoring + +Asset discovery and fingerprinting + +**Features:** +- ARP scanning +- MAC vendor lookup +- OS detection + +![Device Intelligence](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/device-intel.png) + +--- + +### 👁️ Watchdog + +**Category:** Monitoring + +Service and container monitoring + +**Features:** +- Health checks +- Auto-restart +- Alerts + +![Watchdog](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/watchdog.png) + +--- + +### 🎬 Media Flow + +**Category:** Monitoring + +Media traffic analytics + +**Features:** +- Stream detection +- Bandwidth usage +- Protocol analysis + +![Media Flow](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/mediaflow.png) + +--- + +### 📊 Metrics Dashboard + +**Category:** Monitoring + +Real-time system metrics dashboard + +**Features:** +- System overview +- Service status +- WAF/CrowdSec stats +- Connection monitoring +- Live updates + +![Metrics Dashboard](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/metrics.png) + +--- + +### 🔐 Login Portal + +**Category:** Access + +Authentication portal with JWT + +**Features:** +- JWT auth +- Sessions +- Password recovery + +![Login Portal](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/portal.png) + +--- + +### 👥 User Management + +**Category:** Access + +Unified identity management + +**Features:** +- User CRUD +- Groups +- Service provisioning + +![User Management](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/users.png) + +--- + +### 📦 Services Portal + +**Category:** Services + +C3Box services portal + +**Features:** +- Service links +- Status overview +- Quick access + +![Services Portal](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/c3box.png) + +--- + +### 🦊 Gitea + +**Category:** Services + +Git server (LXC) + +**Features:** +- Repositories +- Users +- SSH/HTTP +- LFS + +![Gitea](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/gitea.png) + +--- + +### ☁️ Nextcloud + +**Category:** Services + +File sync (LXC) + +**Features:** +- File sync +- WebDAV +- CalDAV +- CardDAV + +![Nextcloud](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/nextcloud.png) + +--- + +### 📧 Mail Server + +**Category:** Email + +Postfix/Dovecot mail server + +**Features:** +- Domains +- Mailboxes +- DKIM +- SpamAssassin +- ClamAV + +![Mail Server](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/mail.png) + +--- + +### 💌 Webmail + +**Category:** Email + +Roundcube/SOGo webmail + +**Features:** +- Web interface +- Address book +- Calendar + +![Webmail](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/webmail.png) + +--- + +### 📰 Publishing Platform + +**Category:** Publishing + +Unified publishing dashboard + +**Features:** +- Multi-platform +- Scheduling +- Analytics + +![Publishing Platform](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/publish.png) + +--- + +### 💧 Droplet + +**Category:** Publishing + +File upload and publish + +**Features:** +- File upload +- Share links +- Expiration + +![Droplet](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/droplet.png) + +--- + +### 📝 Metablogizer + +**Category:** Publishing + +Static site publisher with Tor + +**Features:** +- Static sites +- Tor publishing +- Templates + +![Metablogizer](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/metablogizer.png) + +--- + +### 🎨 Streamlit + +**Category:** Apps + +Streamlit app platform + +**Features:** +- App hosting +- Deployment +- Management + +![Streamlit](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/streamlit.png) + +--- + +### ⚡ StreamForge + +**Category:** Apps + +Streamlit app development + +**Features:** +- Templates +- Code editor +- Preview + +![StreamForge](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/streamforge.png) + +--- + +### 📦 APT Repository + +**Category:** Apps + +APT repository management + +**Features:** +- Package management +- GPG signing +- Multi-distro + +![APT Repository](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/repo.png) + +--- + +### ⚙️ System Hub + +**Category:** System + +System configuration and management + +**Features:** +- Settings +- Logs +- Services +- Updates + +![System Hub](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/system.png) + +--- + +### 💾 Backup Manager + +**Category:** System + +System and LXC backup + +**Features:** +- Config backup +- LXC snapshots +- Restore + +![Backup Manager](https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/docs/screenshots/vm/backup.png) + +--- + +### 🚫 Ad Guard + +**Category:** Security + +Ad and tracker detection with per-device statistics + +**Features:** +- Blocklist management +- Delayed blacklisting workflow +- Device-type classification +- Per-device statistics + +--- + +### 🖥️ System Administration + +**Category:** System + +Advanced system administration dashboard + +**Features:** +- System status overview +- Systemd service management +- System logs viewer +- APT updates management + +--- + +### 🤖 AI Gateway + +**Category:** AI + +AI Data Sovereignty Gateway + +**Features:** +- Data sovereignty controls +- AI traffic routing +- Privacy-preserving AI access + +--- + +### 🧠 AI Insights + +**Category:** AI + +ML-based threat detection and security insights + +**Features:** +- ML-based threat detection +- Anomaly detection +- Log analysis with trained models +- CrowdSec and Suricata integration + +--- + +### 🎭 Avatar Manager + +**Category:** Access + +Identity and avatar management + +**Features:** +- Avatar upload +- Identity sync across services +- Service integration + +--- + +### 💾 System Cloner + +**Category:** System + +System backup and restore + +**Features:** +- Compressed backup creation +- Backup management +- System restore + +--- + +### 🔧 Config Advisor + +**Category:** Security + +Security configuration advisor + +**Features:** +- Security configuration analysis +- Best practices recommendations +- Configuration scoring + +--- + +### 🖥️ Console TUI + +**Category:** System + +Terminal-based dashboard + +**Features:** +- Live system metrics +- Service management +- Network interface status +- Real-time log viewer + +--- + +### 🍪 Cookie Tracker + +**Category:** Privacy + +Cookie tracking and privacy compliance + +**Features:** +- Third-party cookie detection +- Tracker identification +- GDPR compliance checking + +--- + +### 🔐 CVE Triage + +**Category:** Security + +CVE vulnerability triage + +**Features:** +- Vulnerability assessment +- CVE tracking +- Risk prioritization + +--- + +### 📡 CyberFeed + +**Category:** Security + +Threat intelligence feed aggregator + +**Features:** +- Multi-source threat feed aggregation +- IP and domain blocklist management +- Export to nftables, unbound, dnsmasq + +--- + +### 🛡️ DNS Guard + +**Category:** DNS + +DNS anomaly detection + +**Features:** +- DNS traffic analysis +- Anomaly detection +- Threat alerting + +--- + +### 🌐 DNS Provider + +**Category:** DNS + +Multi-provider DNS API management + +**Features:** +- OVH, Gandi, Cloudflare, AWS Route53 support +- ACME DNS-01 challenge support +- Dynamic DNS + +--- + +### 🏠 Domoticz + +**Category:** Automation + +Home automation management + +**Features:** +- Device management +- Room/scene organization +- Z-Wave, Zigbee, 433MHz support + +--- + +### 📊 Glances + +**Category:** Monitoring + +System monitoring with Glances + +**Features:** +- Real-time CPU, memory, disk, network stats +- Hardware sensors +- Process list + +--- + +### 🦣 GoToSocial + +**Category:** Communication + +ActivityPub/Fediverse server + +**Features:** +- Account management +- Federation controls +- Moderation tools + +--- + +### 📝 Hexo + +**Category:** Publishing + +Static blog generator + +**Features:** +- Multiple blog management +- Theme gallery +- Plugin management + +--- + +### 🏡 Home Assistant + +**Category:** Automation + +IoT hub integration + +**Features:** +- Entity and device browser +- Automation management +- HACS integration + +--- + +### 🆔 Identity + +**Category:** Privacy + +Decentralized identity + +**Features:** +- Decentralized identity management +- Identity verification +- Privacy-preserving auth + +--- + +### 🔍 Interceptor + +**Category:** Security + +HTTP/HTTPS traffic interception + +**Features:** +- SSL/TLS inspection +- Request/response modification +- Traffic recording + +--- + +### 📱 IoT Guard + +**Category:** Security + +IoT device security + +**Features:** +- IoT device monitoring +- Security policy enforcement +- Threat detection + +--- + +### 🚫 IP Block + +**Category:** Security + +IP blocklist manager + +**Features:** +- Multiple blocklist sources +- nftables set integration +- Auto-update scheduling + +--- + +### 💬 Jabber/XMPP + +**Category:** Communication + +Prosody XMPP server + +**Features:** +- User accounts +- Virtual hosts +- Federation + +--- + +### 🎬 Jellyfin + +**Category:** Media + +Media server management + +**Features:** +- Library configuration +- Hardware acceleration +- Backup/restore + +--- + +### 🎥 Jitsi Meet + +**Category:** Communication + +Video conferencing + +**Features:** +- JWT, LDAP authentication +- Recording and streaming +- Breakout rooms + +--- + +### 💾 KSM + +**Category:** System + +Kernel Same-page Merging + +**Features:** +- Enable/disable KSM +- Memory savings statistics +- Configuration tuning + +--- + +### 🤖 LocalAI + +**Category:** AI + +Self-hosted LLM inference + +**Features:** +- OpenAI-compatible API +- Model gallery +- Chat interface + +--- + +### 🧠 LocalRecall + +**Category:** AI + +AI memory system + +**Features:** +- AI context storage +- Memory retrieval +- Context management + +--- + +### 🎵 Lyrion Music Server + +**Category:** Media + +Lyrion Music Server for Squeezebox + +**Features:** +- Squeezebox player control +- Library management +- Backup and restore + +--- + +### 🔒 MAC Guard + +**Category:** Security + +MAC address-based network access control + +**Features:** +- MAC address whitelist/blacklist +- Device discovery +- Alert on unknown devices + +--- + +### 🪞 MagicMirror + +**Category:** Apps + +Smart display platform + +**Features:** +- MagicMirror configuration +- Module management +- Display controls + +--- + +### 📬 Mail LXC + +**Category:** Email + +Mail server LXC container + +**Features:** +- Postfix MTA +- Dovecot IMAP/POP3 +- OpenDKIM signing + +--- + +### 🔗 Master Link + +**Category:** Network + +Mesh node enrollment + +**Features:** +- Node enrollment +- Mesh link management +- Topology coordination + +--- + +### 💬 Matrix Synapse + +**Category:** Communication + +Federated chat server + +**Features:** +- User and room management +- Bridge support +- Federation + +--- + +### 🤖 MCP Server + +**Category:** AI + +Model Context Protocol server + +**Features:** +- AI context protocol support +- Model communication +- Context sharing + +--- + +### 📋 Metabolizer + +**Category:** Monitoring + +Log processor and analyzer + +**Features:** +- Journalctl log analysis +- Pattern extraction +- Error trend analysis + +--- + +### 📚 Metacatalog + +**Category:** Services + +Service catalog and registry + +**Features:** +- Service health status +- Dependency mapping +- API endpoint documentation + +--- + +### 🪞 Mirror/CDN + +**Category:** Network + +Local mirror and CDN caching + +**Features:** +- Nginx caching proxy +- Cache statistics +- Bandwidth optimization + +--- + +### 📦 MMPM + +**Category:** Apps + +MagicMirror Package Manager + +**Features:** +- Browse MagicMirror modules +- Install/update/remove modules + +--- + +### 📡 MQTT + +**Category:** Automation + +Mosquitto MQTT broker + +**Features:** +- Client connection tracking +- Topic monitoring +- User and ACL management + +--- + +### 🔬 nDPId + +**Category:** Monitoring + +Deep Packet Inspection with nDPI + +**Features:** +- JA3/JA4 TLS fingerprinting +- Protocol detection +- Risk scoring + +--- + +### 🔧 Network Diagnostics + +**Category:** Network + +Network troubleshooting tools + +**Features:** +- Ping, traceroute, DNS lookup +- WHOIS, MTR +- Port scanning, bandwidth testing + +--- + +### ⚙️ Network Tuning + +**Category:** Network + +Sysctl and TCP/IP optimization + +**Features:** +- Tuning profiles +- TCP settings +- Persistent configuration + +--- + +### 🔍 Network Anomaly + +**Category:** Security + +Network anomaly detection + +**Features:** +- Traffic analysis +- Anomaly detection +- Alert generation + +--- + +### 📰 Newsbin + +**Category:** Apps + +Usenet downloader (SABnzbd) + +**Features:** +- NZB file handling +- Download queue +- Category organization + +--- + +### 🦙 Ollama + +**Category:** AI + +Local LLM inference + +**Features:** +- Model pulling +- Chat completion +- Text generation APIs + +--- + +### 🕵️ OpenClaw OSINT + +**Category:** Security + +Open Source Intelligence + +**Features:** +- Domain reconnaissance +- IP intelligence +- Subdomain discovery + +--- + +### 🛡️ OSSEC HIDS + +**Category:** Security + +Host-based Intrusion Detection + +**Features:** +- Alert viewing +- File integrity monitoring +- Rootkit detection + +--- + +### 📹 PeerTube + +**Category:** Media + +Federated video platform + +**Features:** +- Video and channel management +- Federation (ActivityPub) +- Plugin management + +--- + +### 📸 PhotoPrism + +**Category:** Media + +AI-powered photo management + +**Features:** +- AI-powered face recognition +- Photo library indexing +- Album management + +--- + +### 🍺 PicoBrew + +**Category:** Automation + +Homebrew/fermentation controller + +**Features:** +- Temperature monitoring +- Fermentation profiles +- Recipe management + +--- + +### 📱 Redroid + +**Category:** Apps + +Android in container + +**Features:** +- Android container management +- ADB access +- App installation + +--- + +### 📊 Reporter + +**Category:** System + +System report generation + +**Features:** +- PDF/HTML reports +- Scheduled generation +- Security reports + +--- + +### 📦 RezApp + +**Category:** Apps + +Application deployment + +**Features:** +- Application templates +- Docker/LXC deployment +- Health monitoring + +--- + +### 🛣️ Routes + +**Category:** Network + +Routing table manager + +**Features:** +- View IPv4/IPv6 routes +- Add/delete routes +- Policy routing rules + +--- + +### 🖥️ RTTY + +**Category:** System + +Remote terminal access + +**Features:** +- Terminal sessions +- Access token management +- Web interface + +--- + +### 🔌 SaaS Relay + +**Category:** Services + +Secure API proxy relay + +**Features:** +- Proxy configuration +- API key management +- Rate limiting + +--- + +### 🔐 SimpleX Chat + +**Category:** Communication + +Privacy-focused messaging + +**Features:** +- Zero-knowledge messaging +- No user identifiers +- TLS certificate management + +--- + +### 📧 SMTP Relay + +**Category:** Email + +Email forwarding + +**Features:** +- Queue management +- Smarthost configuration +- Monitoring + +--- + +### 🛡️ SOC Agent + +**Category:** Security + +Edge node agent + +**Features:** +- Metrics collection +- Alert aggregation +- Remote command execution + +--- + +### 🏢 SOC Gateway + +**Category:** Security + +Central fleet monitoring hub + +**Features:** +- Node registration +- Fleet-wide metrics +- Threat correlation + +--- + +### 🌐 SOC Web + +**Category:** Dashboard + +Fleet monitoring dashboard + +**Features:** +- Fleet overview +- Real-time alerts +- Threat visualization + +--- + +### 🤖 Threat Analyst + +**Category:** AI + +AI threat analysis + +**Features:** +- AI-powered analysis +- Automated assessment +- Intelligence correlation + +--- + +### ⚠️ Threats Dashboard + +**Category:** Security + +Unified security threats + +**Features:** +- Aggregated alerts +- Threat intelligence +- Incident tracking + +--- + +### 📥 Torrent + +**Category:** Apps + +BitTorrent client (Transmission) + +**Features:** +- Magnet links, URLs, files +- Speed limiting +- RSS feed subscriptions + +--- + +### 📞 TURN/STUN Server + +**Category:** Communication + +WebRTC relay server + +**Features:** +- coturn service +- User management +- Temporary credentials + +--- + +### 🔐 Vault + +**Category:** Security + +Encrypted secrets management + +**Features:** +- Secure storage +- Audit logging +- Rotation support + +--- + +### 💻 VM Manager + +**Category:** System + +Virtual machine management + +**Features:** +- KVM/QEMU VMs +- LXC containers +- Resource management + +--- + +### 📞 VoIP/PBX + +**Category:** Communication + +Asterisk/FreePBX management + +**Features:** +- Extension management +- SIP trunks +- Call detail records + +--- + +### 🛡️ Wazuh SIEM + +**Category:** Security + +Wazuh SIEM integration + +**Features:** +- Agent/manager management +- Alert viewing +- Security monitoring + +--- + +### 📬 Webmail LXC + +**Category:** Email + +Roundcube webmail container + +**Features:** +- Roundcube webmail +- Nginx + PHP-FPM +- Auto-configuration + +--- + +### 📻 Web Radio + +**Category:** Media + +Internet radio streaming + +**Features:** +- Station management +- Icecast/Liquidsoap server +- Recording functionality + +--- + +### 📡 Zigbee + +**Category:** Automation + +Zigbee2MQTT gateway + +**Features:** +- Device pairing +- MQTT integration +- Network topology + +--- + diff --git a/docs/wiki/_Sidebar.md b/docs/wiki/_Sidebar.md index cc565d02..13639edc 100644 --- a/docs/wiki/_Sidebar.md +++ b/docs/wiki/_Sidebar.md @@ -1,12 +1,44 @@ -## Navigation +**[SecuBox](Home)** | [FR](Home-FR) | [DE](Home-DE) | [中文](Home-ZH) | **v2.0.0** -**[Home](Home)** +### 🔴 BOOT — Getting Started +* [[Live-USB-VirtualBox|VirtualBox]] ⭐ +* [[Live-USB-QEMU|QEMU]] 🖥️ +* [[Live-USB]] +* [[Installation]] +* [[ARM-Installation|ARM / U-Boot]] ⚡ +* [[Hardware-ESPRESSObin|ESPRESSObin]] +* [[Hardware-MOCHAbin|MOCHAbin]] +* [[QEMU-ARM64]] 🖥️ -### Eye Remote -- [Implementation](Eye-Remote-Implementation) -- [Hardware](Eye-Remote-Hardware) -- [Gateway & Emulator](Eye-Remote-Gateway) +### 🟢 ROOT — Configuration +* [[Configuration]] +* [[Configuration-Advanced]] +* [[Troubleshooting]] -### Project -- [Migration Guide](../PORTING-GUIDE) -- [CLAUDE.md](../../CLAUDE) +### 🟣 MIND — Architecture +* [[Architecture-Boot|Boot Architecture]] +* [[Architecture-Modules|Module Design]] +* [[Architecture-Security|Security Model]] +* [[Design-System|UI/UX Design]] + +### 🟡 WALL — Modules +* [[Modules|All Modules (125)]] +* [[Modules-Security]] +* [[Modules-Networking]] +* [[Modules-Monitoring]] + +### 🔵 MESH — Reference +* [[API-Reference]] +* [[Developer-Guide]] +* [[Developer-Patterns]] +* [[UI-Comparison]] + +### 👁️ Eye Remote +* [[Eye-Remote-Implementation]] +* [[Eye-Remote-Hardware]] +* [[Eye-Remote-Gateway]] + +### Links +* [Releases](https://github.com/CyberMind-FR/secubox-deb/releases) +* [Issues](https://github.com/CyberMind-FR/secubox-deb/issues) +* [CyberMind](https://cybermind.fr) diff --git a/remote-ui/round/fb_dashboard.py b/remote-ui/round/fb_dashboard.py index 4cf868d0..105c00a4 100644 --- a/remote-ui/round/fb_dashboard.py +++ b/remote-ui/round/fb_dashboard.py @@ -71,7 +71,7 @@ class AgentMetricsSource: self.sim = SimulatedMetrics() self._last_data = None - def _read_from_socket(self) -> dict: + def _read_from_socket(self) -> dict | None: """Read metrics from agent Unix socket.""" try: s = sock_module.socket(sock_module.AF_UNIX, sock_module.SOCK_STREAM)